Fintech RegulationsEmerson S. Banez

UP College of Law

Fintech Defined

• Fintech does not yet have an established meaning in Philippine law.

• The term is broadly used by policy pronouncements to apply to any “technological development in finance”.

• For this paper, Fintech applies to offerings that belong to a category of financial services that are deployed through the Internet and/or mobile applications.

Technology, Disruption and the law

• Historically, economic activity is conducted within the possibilities and limitations of a particular setting of technology and applicable law.

• The law arises from this technological substrate, defining further constraints at the margin of existing technological capabilities.

• When disruptive technologies arrive, the corresponding benefits cause market incentives to shift and affect earlier arrangements structured in part by the rules shaped by the law. • The greater the disruption and higher level of regulatory mechanisms lead to

a wider regulatory gap.

The Legal Ontology of Financial Services

• Every regulatory regime relies on an ontology.

• The country’s financial regulations were developed along side contractual arrangements and institutions that have not seen fundamental changes for decades.

• When confronted with financial innovations, the government is often constrained to shoehorn these innovations into its traditional understanding of relevant concepts. • Resulting in rules that are inconsistent or overlapping jurisdictions.

What is an ontology

• “The philosophical study of the nature of being, becoming, existence, or reality…” – NOT

• Computer/Information science – A formal naming and definition of the types, properties, and interrelationships of the entities that really exist in a particular domain or discourse.

• Applications in artificial intelligence, library science…

The Semantic Web

• From Tim Berners Lee (web of data)

• Aim – to make the web more “understandable” for computers.

• For example, by making the categories and relationships of some concepts more explicit

• More relevant search results, easier navigation through the data

• Can be used also for reasoning, argumentation support of AI

The Semantic Web

The Semantic Web:RDF

The Semantic Web: RDF

Legal Knowledge Interchange Format

Problems that Arise from Applying Old laws to New Technology

• Inconsistency of terms• A concept as understood in the Fintech taxonomy may have materially different content from a

traditional financial taxonomy.

• Overlapping Jurisdictions• Different agencies may regulate activities covered by different terms that are similar.

• Concepts not covered by existing taxonomies• Concepts created by new technologies may not be accounted for in traditional taxonomies.

• Implementation mismatch• Agencies can only interface with a concept at a particular level, level some details absent or

incompatible.

• Policy conflict• A norm that may not conform with other policy considerations.

Categories of Financial Regulation

• Compliance Laws• These are rules that are not intended to address the market structure for

specific services.

• These apply to actors in the financial sector regardless of the service they offer.

• Regulatory Laws• These are laws and regulations that shape the market.

• These can constrain activities in specific services to fit policy preferences.

Analysis Questions

• What are the laws and regulations that govern the country’s financial industry?

• Who are the actors of the financial sector recognized under the country’s laws?

• What are the objects in the financial sector recognized under the country’s laws?

• What are the processes in the financial sector recognized under the country’s laws?

• What are the norms applicable to the actors, objects, and processes of the traditional (i.e. non Fintech) financial sector?

• What are the categories of Fintech services?

• What laws and regulations are directly applicable to Fintech?

• What laws and regulations for the traditional financial sector are applicable to Fintech?

• What are the potential issues in applying these regulations to Fintech?

The Current Regulatory Framework

Regulatory StatutesBusiness Category Regulatory Statute Regulator

Bank The General Banking Law of 2000 (RA 8791)Manual of Regulations for Banks

BSP

Quasi-Bank The General Banking Law of 2000 (RA 8791)Lending Company Regulation Act (RA 9474)Manual of Regulations for Non-Bank Financial Institutions –Regulations Governing Non-Bank Financial Institutions Performing Quasi-Banking Functions (MORNBFI – Q Regulations)

BSP

Regulatory StatutesBusiness Category Regulatory Statute Regulator

Trust Entity The General Banking Law of 2000 (RA 8791)Manual of Regulations for Non-Bank Financial Institutions –Regulations Governing Trust Corporations (MORNBFI – T Regulations)

BSP

Pawnshop Pawnshop Regulation Act (PD 114)Manual of Regulations for Non-Bank Financial Institutions –Regulations Governing Pawnshops (MORNBFI – P Regulations)

BSP

Regulatory StatutesBusiness Category Regulatory Statute Regulator

Non-Stock Savings and Loans Associations (NSSLA’s)

Revised Non-Stock Savings and Loan Association Act of 1997 (RA 8367) Manual of Regulations for Non-Bank Financial Institutions -Regulations Governing Non-Stock Savings and Loan Associations (MORNBFI - S Regulations)

BSP

Remittance and Transfer Companies (RTC’s)

Manual of Regulations for Non-Bank Financial Institutions -Regulations Governing Other Non-Bank Financial Institutions (MORNBFI - N Regulations), Section 4511N, as amended by BSP Circular No. 942 s. 2017

BSP

Regulatory StatutesBusiness Category Regulatory Statute Regulator

Money Changer (MC)/Foreign Exchange Dealer (FXD)

Non-Bank Financial Institutions -Regulations Governing Other NonBank Financial Institutions (MORNBFI - N Regulations), Section 4511N, as amended by BSP Circular No. 942 s. 2017

BSP

Investment House Investment House Law (PD 129) SEC

Financing Company Financing Company Act (RA 5980)

SEC

Lending Company Lending Company Regulation Act (RA 9474)

SEC

Broker Securities Regulation Code (RA 8799)

SEC

Regulatory StatutesBusiness Category Regulatory Statute Regulator

Clearing Agency Securities Regulation Code (RA 8799)

SEC

Exchange Securities Regulation Code (RA 8799)

SEC

Underwriter Securities Regulation Code (RA 8799)

SEC

Issuer Securities Regulation Code (RA 8799)

SEC

Investment Company Investment Company Act (RA 2629)

SEC

Investment Banker Investment Company Act (RA 2629)

SEC

Real Estate Investment Trust (REIT)

REIT Act (RA 9856) SEC

Regulatory Statutes

Business Category Regulatory Statute Regulator

Insurance Company Insurance Code (RA 10607) IC

Insurance Agents Insurance Code (RA 10607) IC

Insurance Broker Insurance Code (RA 10607) IC

Professional Reinsurer Insurance Code (RA 10607) IC

Reinsurance Brokers Insurance Code (RA 10607) IC

Holding Company Insurance Code (RA 10607) IC

Holding Company System Insurance Code (RA 10607) IC

Mutual Benefit Associations Insurance Code (RA 10607) IC

Pre-Need Companies Insurance Code (RA 10607) IC

Anti-Money Laundering Act of 2001

• Made to implement the state policy to “protect and [reserve the integrity and confidentiality of bank accounts and to ensure that the Philippines shall not be used as a money laundering site for the proceeds of any unlawful activity”.

• Applies to covered persons as defined by Section X802 of MORB as amended by Section 1 of BSP Circular No. 950.

• Fintech companies may be considered as covered persons since their activities are similar to the covered persons.

• However a direct application of the Act proves to be difficult due to how technology has transformed how financial services are delivered.

Data Privacy Act of 2012

• Since Fintech companies collect personal sensitive information the Data Privacy Act finds application as this Act applies to anyone who controls or uses personal information.

• The Act protects Personal Information and Sensitive Personal Information.

• The Act requires Fintech companies to uphold the data privacy rights of their clients and to adhere to the general principles of data privacy.

Data Privacy Act of 2012

• There are four areas which Fintech companies are particularly affected; Consent, Notification and Registration of Automated Decision-Making Processes, DPO Appointment, and Data Breach Notification.

• Consent is necessary for Personal or Sensitive Personal Information to be processed by a data controller.• The data subject must give his or her consent, specific to the purpose prior to the processing,

or in the case of privileged information, all parties to the exchange have given their consent prior to processing.

• Consent must also be evidenced by written electronic or recorded means.

• The law also does not accept implied consent of the data subject.

Philippine Competition Act

• The Philippine Competition Act seeks to maintain a healthy level of competition in the marketplace.

• Under such Act Anti-Competitive Agreements, and Abuse of Dominant Position are prohibited.

• The Act also allows the Competition Commission to review mergers and acquisitions.

• Companies are also required to notify the Commission in case a merger or acquisition reaches a threshold as determined by the Commission.

SEC Rules on Mass Media

• Mass media refers to any medium of communication designed to reach the masses, the distinctive feature of which is the dissemination of information and ideas to the public.

• It is not limited to physical structures and printed materials, it can cover the internet.

• Hence, the SEC considers corporations that provide an online platform that brings parties together for increasing sales fall under mass media.

SEC Rules on Mass Media

• A Fintech company that provides information and makes it available to the general public is considered a mass media entity.

• This is significant as the Constitution requires mass media to be wholly owned by Filipinos.

• This limitation on foreign ownership hinders the importation of potential capital, technology, production, skills, and management systems.

• This also inhibits healthy competition within the industry.

• It causes the country to loss potential tax revenues from profits of foreign Fintech Corporations.

Cybersecurity and Cybercrime

• The BSP has the duty to determine the IT profile of all BSFIs and classify them as Complex, Moderate of Simple.

• Based on such evaluation the BSFI is required to adopt a robust IT risk management system; IT Governance; Risk Identification and Assessment; IT controls implementation; and Risk measurement and monitoring.

• Failure to comply will result in sanctions under RA 7653

Cybersecurity and Cybercrime

• The Supreme Court has also issued the Rule on Cybercrime Warrants.

• It provides for the venue for the warrants

• Preservation orders under the Cybercrime Prevention Act

• Remedies like disclosure orders, real-time collection of content data, and search and seizure warrants.

• A Warrant to Disclose Computer Data is issued to authorize Law Enforcement Authorities (LEA) to issue an order to disclose or submit subscriber’s information, traffic data, or relevant data.

• A Warrant to Intercept Computer Data is granted to authorize the LEA to listen, record, monitor or surveil the content of communications.

Department of Information and Communications Technology• The Department of Information and Communications Technology

(DICT) is the primary policy, planning, coordinating, implementing, and administrative entity of the executive branch of the government.

• It is tasked to plan, develop and promote the national Information and Communications Technology development agenda.

• This places the DICT in a crucial role in selecting and adopting technology standards for the government.

• It affects public procurement and can shape the Fintech market through public endorsement and network effects that will be made available to those services that comply with the adopted standards.

Department of Information and Communications Technology• This can affect what standard will be imposed upon other played

whether they act in the private sector or if they wish to interface with the government.

• The DICT also has the power to create guidelines on partnerships between public and private entities, allowing the DICT to control relations between Fintech companies and the government in the integration of Fintech services.

The Philippine Identification System Act

• The Philippine Identification System Act creates a central identification platform for all citizens and resident aliens in the Philippines.

• This involves the PhilSys Number (PSN), the PhilSys Registry and the PhilID.

• The PSN is a randomly generated, unique, and permanent identification number that will be assigned to every citizen

• The PhilSys Registry is the repository of all data

• The PhilID is the physical medium issued to convey essential information of a person such as the PSN, Full name, sex, blood type, marital status, place of birth, photo, date of birth and address.

The Philippine Identification System Act

• Fintech companies rely on personal information and are covered by the KYC Policy of the BSP

• Through the PhilID the implementation of the KYC will be fast tracked as the ID will be sufficient proof of identity to open bank accounts and avail financial services.

• Refusal to accept the PhilID may result in a monetary fine, if such refusal was without just and sufficient cause.

• The law also penalizes the unauthorized and willful use or disclosure of the data.

• The implementation of this system may result in an increase of clients for Fintech companies.

Secured Transactions Law

• This law seeks to enable financial institutions to rethink how they view collateral and reduce perceived risks, by providing protection framework to govern lending transactions that involve the use of personal property as collateral, as well as the design, establishment, and operation of a unified, centralized, online based national collateral registry to assure banks that the collateral being submitted has not already been utilized for another loan.

Conclusion

The basis for rational policymaking and the modern administrative state is that legal requirements are supposed to address specific problems or channel behavior towards desirable outcomes. The regulation of the country’s financial sector is in place to encourage stability, build trust, and promote inclusion of traditionally underserved sections the public.

In case of doubt the rules and requirements for traditional financial institutions will be applied to Fintech companies. Since policy preferences could be embedded in Fintech through less onerous means, the reflexive application of old regulations to new tech is inefficient and self-defeating. We propose that policymakers adopt a calibrated “light touch” approach, or the delineation of a “regulatory sandbox” for Fintech. Vigilance and prudence can be balanced with innovation at ratios that promote the public welfare.